CLAIMS 

1 . A method for analyzing one-way delay in a packet switched network, comprising: 
varying a Time To Live (TTL) value in a trace packet to intentionally cause an 

intermediate node in the packet switched network to send back a packet expiration notice; 
and 

receiving an intermediate node time value in the packet expiration notice indicating 
when the intermediate node received the trace packet. 

2. The method according to claim 1 including sending a source time value in the trace 
packet indicating when the trace packet was sent and receiving both the source time value 
and the intermediate node time value in the packet expiration notice. 

3. The method according to claim 1 including: 

setting a first TTL value in a first trace packet causing a first intermediate node to 
send back a first packet expiration notice with a first time value associated with a one-way 
packet delay to the first intermediate node; and 

setting a second larger TTL value in a second trace packet causing a second 
intermediate node to send back a second expiration notice with a second time value 
associated with a one-way packet delay to the second intermediate node. 

4. The method according to claim 3 including setting incrementally increasing TTL 
values in additional trace packets until a destination endpoint sends back a packet expiration 
notice with a time value associated with a one-way packet delay from the source endpoint to 
the destination endpoint. 
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5 5. The method according to claim 1 including: 

using a Network Time Protocol (NTP) timestamp value for the intermediate node time 

value; 

inserting the NTP timestamp value into an Internet Control Message Protocol (ICMP) 
reply message; and 
10 using the ICMP reply message as the packet expiration notice. 

6. The method according to claim 5 including using bits in an existing field of the ICMP 
reply message for containing the NTP timestamp value. 

15 7. The method according to claim 1 including formatting the trace packet as a Real Time 
Protocol (RTP) payload packet that travels along a same media path as corresponding RTP 
payload packets containing media content. 

8. The method according to claim 7 including varying the TTL value and setting a 
20 marker bit in the trace packet causing a destination endpoint for the trace packet to send a 

corresponding Real Time Control Protocol (RTCP) report. 

9. The method according to claim 8 including determining whether or not to transmit a 
media stream according to contents of the RTCP report. 

25 

10. A network processing device, comprising: 



Patent Application 

Attorney Docket No. 2705-326 

Cisco Sequence No. 8218 



31 



5 a processor sending a packet that intentionally causes an intermediary node to send 

back a message containing an intermediate node timestamp value identifying when the packet 
reached the intermediate node. 

1 1 . The network processing device according to claim 1 0 wherein the processor causes 
10 the intermediate node to decrement a Time To Live (TTL) value in the packet and send back 

the message when the TTL value is decremented to zero. 

12. The network processing device according to claim 1 1 wherein the processor modifies 
the TTL values in multiple packets causing multiple different intermediate nodes in a 

1 5 network to send back messages each containing intermediate node timestamp values when 
the TTL values in the packets are decremented to zero by that intermediate node. 

13. The network processing device according to claim 10 wherein the processor discerns 
when the packet was sent and compares that time with the intermediate node timestamp value 

20 returned in the message to determine the one-way packet delay between the processor and the 
intermediate node. 

14. The network processing device according to claim 10 wherein the processor formats 
the packet as a Real Time Protocol (RTP) payload packet that travels along a same media 

25 path as associated RTP payload packets containing an actual media payload. 
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5 15. The network processing device according to claim 14 wherein the processor sets a 
Time To Live (TTL) value and a marker bit in the probe packet that causes a destination 
endpoint for the packet to send back a Real Time Control Protocol (RTCP) report. 

16. A network processing device, comprising: 

10 a processor configured to receive a trace packet containing an expiration value 

causing the processor to discard the trace packet and generate an expiration message that 
identifies a time value associated with when the trace packet was received by the processor. 

17. The network processing device according to claim 16 wherein the network processing 
1 5 device is located at an intermediate location in a network between a source endpoint sending 

the trace packet and a destination endpoint for the trace packet. 

18. The network processing device according to claim .17 wherein the processor is 
configured to decrement the expiration value and forward the trace packet toward the 

20 destination endpoint when the decremented expiration value is not zero, the processor further 
configured to discard the trace packet and send the expiration message back to the source 
endpoint when the expiration value is decremented to zero. 

19. The network processing device according to claim 16 wherein the processor uses an 
Internet Control Message Protocol (ICMP) reply message as the expiration message and uses 
a Network Time Protocol (NTP) timestamp value as the time value. 
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20. The network processing device according to claim 16 wherein the trace packet is 
formatted as a media payload packet that uses a same media path as associated media packets 
containing a media payload. 

21 . A system for analyzing one-way delay in a packet switched network, comprising: 
means for varying a Time To Live (TTL) value in a trace packet to intentionally cause 

an intermediate node in the packet switched network to send back a packet expiration notice; 
and 

means for receiving an intermediate node time value in the packet expiration notice 
indicating when the intermediate node received the trace packet. 

.22. A system according to claim 21 including means for sending a source time value in 
the trace packet indicating when the trace packet was sent and receiving both the source time 
value and the intermediate node time value in the packet expiration notice. 

23. A system according to claim 21 including: 

means for setting a first TTL value in a first trace packet causing a first intermediate 
node to send back a first packet expiration notice with a first time value associated with a 
one-way packet delay to the first intermediate node; and 

means for setting a second larger TTL value in a second trace packet causing a second 
intermediate node to send back a second expiration notice with a second time value 
associated with a one-way packet delay to the second intermediate node. 
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5 24. A system according to claim 23 including means for setting incrementally increasing 
TTL values in additional trace packets until a destination endpoint sends back a packet 
expiration notice with a time value associated with a one-way packet delay from the source 
endpoint to the destination endpoint. 

25. A system according to claim 21 including: 
means for using a Network Time Protocol (NTP) timestamp value for the intermediate 

node time value; 

means for inserting the NTP timestamp value into an Internet Control Message 
Protocol (ICMP) reply message; and 

means for using the ICMP reply message as the packet expiration notice. 

26. A system according to claim 25 including means for using bits in an existing field of 
the ICMP reply message for containing the NTP timestamp value. 

20 27. A system according to claim 21 including means for formatting the trace packet as a 
Real Time Protocol (RTP) payload packet that travels along a same media path as 
corresponding RTP payload packets containing media content. 

28. A system according to claim 27 including means for varying the TTL value and 
25 setting a marker bit in the trace packet causing a destination endpoint for the trace packet to 
send a corresponding Real Time Control Protocol (RTCP) report. 
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5 29. A system according to claim 28 including means for determining whether or not to 
transmit a media stream according to contents of the RTCP report. 

30. A computer readable medium for analyzing one-way delay in a packet switched 
network, comprising: 

10 varying a Time To Live (TTL) value in a trace packet to intentionally cause an 

intermediate node in the packet switched network to send back a packet expiration notice; 
and 

receiving an intermediate node time value in the packet expiration notice indicating 
when the intermediate node received the trace packet. 

15 

31 . A computer readable medium according to claim 30 including sending a source time 
value in the trace packet indicating when the trace packet was sent and receiving both the 
source time value and the intermediate node time value in the packet expiration notice. 

20 32. A computer readable medium according to claim 30 including: 

setting a first TTL value in a first trace packet causing a first intermediate node to 
send back a first packet expiration notice with a first time value associated with a one-way 
packet delay to the first intermediate node; and 

setting a second larger TTL value in a second trace packet causing a second 
25 intermediate node to send back a second expiration notice with a second time value 
associated with a one-way packet delay to the second intermediate node. 
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5 33. A computer readable medium according to claim 32 including setting incrementally 
increasing TTL values in additional trace packets until a destination endpoint sends back a 
packet expiration notice with a time value associated with a one-way packet delay from the 
source endpoint to the destination endpoint. 

10 34. A computer readable medium according to claim 30 including: 

using a Network Time Protocol (NTP) timestamp value for the intermediate node time 

value; 

inserting the NTP timestamp value into an Internet Control Message Protocol (ICMP) 
reply message; and 
15 using the ICMP reply message as the packet expiration notice. 

35. A computer readable medium according to claim 34 including using bits in an 
existing field of the ICMP reply message for containing the NTP timestamp value. 

20 36. A computer readable medium according to claim 30 including formatting the trace 

packet as a Real Time Protocol (RTP) payload packet that travels along a same media path as 
corresponding RTP payload packets containing media content. 

37. A computer readable medium according to claim 36 including varying the TTL value 
25 and setting a marker bit in the trace packet causing a destination endpoint for the trace packet 
to send a corresponding Real Time Control Protocol (RTCP) report. 
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5 38. A computer readable medium according to claim 37 including determining whether or 
not to transmit a media stream according to contents of the RTCP report. 



10 



15 
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